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DETAILED ACTION 

1 . This action is responsive to the communication filed on October 01 , 2003. 
Claims 1-66 are pending. At this time, claims 1-66 are rejected. 

Information Disclosure Statement 

2. The information disclosure statement (IDS) filed on January 20, 2004, 
September 26, 2005, and October 20, 2005. The submission is in compliance with the 
provisions of 37 CFR1.97. Accordingly, the information disclosure statements are 
being considered by the examiner. 

Claim Rejections - 35 USC § 101 

3. 35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition 
of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the 
conditions and requirements of this title. 

4. Claims 1-66 are rejected under 35 U.S.C. 101 because the claimed 
invention is directed to non-statutory subject matter. 

Claim 1 recites "a method comprising: observing communication between 
a plurality of devices; and inferring a respective state of at least one device of the 
plurality of devices based upon the observing the communication." The claim is clearly a 
software program and it is non-statutory as not being tangibly embodied in a manner so 
as to be executable. Therefore, claim 1 recites a non-statutory subject matter. 

Claims 2-42 are dependent of claim 1, thus they are rejected with the 
same rationale applied against claim 1 above. 

Claim 43 has limitation that is similar to those of claim 1, thus they are 
rejected with the same rationale applied against claim 1 above. 

Claims 44-54 are dependent of claim 43, thus they are rejected with the 
same rationale applied against claim 43 above. 

Claim 55 has limitation that is similar to those of claim 1, thus they are 
rejected with the same rationale applied against claim 1 above. 

Claims 56-66 are dependent of claim 55, thus they are rejected with the 
same rationale applied against claim 55 above. 
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Claim Rejections - 35 USC § 102 

5. The following is a quotation of the appropriate paragraphs of 35 
U.S.C. 102 that form the basis for the rejections under this section made in this Office 
action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by 
another filed in the United States before the invention by the applicant for patent or (2) a patent 
granted on an application for patent by another filed in the United States before the invention by the 
applicant for patent, except that an international application filed under the treaty defined in section 
351(a) shall have the effects for purposes of this subsection of an application filed in the United States 
only if the international application designated the United States and was published under Article 21(2) 
of such treaty in the English language. 

6. Claims 1, 3-66 are rejected under 35 U.S.C. 102(e) as being anticipated 
by Carter et al (US 2003/0051026). 

a. Referring to claim 1: 

i. Carter teaches a method comprising: 

(1) observing communication between a plurality of 
devices (paragraph 0219 of Carter); and 

(2) inferring a respective state of at least one device of 
the plurality of devices based upon the observing the communication (paragraphs 0219 
and 0242 of Carter). 

b. Referring to claim 3: 

i. Carter further teaches: 

(1) wherein the inferring is performed without 
participating in the communication with the at least one device (paragraph 0560 of 
Carter). 

c. Referring to claim 4: 

i. Carter further teaches: 

(1) wherein the inferring is performed only by listening 
(e.g., eavesdropping) to the communication with the at least one device (paragraphs 
0122, 0560 and 1066 of Carter). 

d. Referring to claim 5: 
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i. Carter further teaches: 

(1) setting a designation for a first device of the plurality 
of devices to a threat when the first device receives a packet and the respective state of 
the first device is unfulfilled (paragraphs 0006 and 0260-0261 of Carter). 

e. Referring to claim 6: 

i. Carter further teaches: 

(1) changing the designation for the first device to a non- 
threat when subsequent communication initiated by the first device does not violate a 
rule for the communication (paragraphs 0479 and 0785-0787 of Carter). 

f. Referring to claim 7: 

i. Carter further teaches: 

(1) setting a designation for a first device of the plurality 
of devices to a possible threat when the communication is initiated by the first device 
(paragraphs 0006 and 0260-0261 of Carter), and the communication initiated by the first 
device violates a rule (paragraphs 0787, 0790, 0978-0984 of Carter). 

g. Referring to claim 8: 

i. Carter further teaches: 

(1) changing the designation for the first device to a non- 
threat when subsequent communication initiated by the first device does not violate a 
second rule for the communication (paragraphs 0479 and 0785-0787 of Carter). 

h. Referring to claim 9: 

i. Carter further teaches: 

(1) setting a designation for a first device of the at least 
one device to a possible threat based upon a packet configuration for a packet sent by 
the first device as part of the communication (paragraphs 0006 and 0260-0261 of 
Carter). 

i. Referring to claim 10: 

i. Carter further teaches: 

(1 ) the respective state of a first device of the at least one 
device is determined to be unknown (paragraphs 0260-0261 and 0652 of Carter). 
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j. Referring to claim 1 1: 

i. Carter further teaches: 

(1 ) the respective state of the first device is determined to 
be unknown (paragraphs 0260-0261 and 0652 of Carter) when the observing the 
communication comprises observing that the first device fails to respond to the 
communication sent to the first device (paragraphs 0289, 0787, and 0985 of Carter), 
k. Referring to claim 12: 

i. Carter further teaches: 

(1 ) the respective state of a first device of the at least one 
device is determined to be unfulfilled (paragraphs 0006 and 0260-0261 of Carter). 
I. Referring to claim 13: 

i. Carter further teaches: 

(1 ) the respective state of the first device is determined to 
be unfulfilled when the observing the communication comprises: 

(2) observing an address resolution protocol request 
comprising a destination address for the first device (paragraphs 0028 and 0084 of 
Carter), and 

(3) observing that the first device does not respond to the 
address resolution protocol request prior to expiration of a time limit (paragraphs 0028, 
0084, and 0152 of Carter). 

m. Referring to claim 14: 

i. This claim has limitations that is similar to those of claim 1 1 , 
thus it is rejected with the same rationale applied against claim 1 1 above, 
n. Referring to claim 15: 

i. Carter further teaches: 

(1) the respective state of a first device of the plurality of 
- devices is determined to be used (paragraphs 0260-0261 and 0652 of Carter). 

o. Referring to claim 16: 

i. Carter further teaches: 



Application/Control Number: 10/676,541 Page 6 

Art Unit: 2135 

(1) the respective state of the first device is determined to 
be used when the observing the communication comprises observing that the first 
device performs one of sending and receiving a packet (paragraphs 0019, 0023-0024, 
and 0028 of Carter). 

p. Referring to claim 17: 

i. Carter further teaches: 

(1) the respective state of the first device is determined to 
be used when the observing the communication comprises: 

(2) observing that the first device received a packet when 
the respective state for the first device was unfulfilled (paragraphs 0006 and 0260- 
0261 of Carter), and 

(3) observing that the first device sent a reply to the 
packet within a time limit (paragraphs 0028, 0084, and 0152 of Carter). 

q. Referring to claim 18: 

i. Carter further teaches: 

(1) wherein the respective state of a first device of the 
plurality of devices is determined to be virtual (paragraphs 0011 and 0166 of Carter), 
r. Referring to claim 19: 

i. Carter further teaches: 

(1) wherein the respective state of the first device is 
determined to be virtual when the observing the communication comprises: 

(2) observing that the first device received a packet when 
the respective state for the first device was unfulfilled (paragraphs 0006 and 0260- 
0261 of Carter), and 

(3) observing that the first device did not send a reply to 
the packet within a time limit (paragraphs 0028, 0084, 0152, and 0870 of Carter). 

s. Referring to claim 20: 

i. Carter further teaches: 



Application/Control Number: 10/676,541 Page 7 

Art Unit: 2135 

(1) wherein the respective state of a first device of the 
plurality of devices is determined to be automatic (paragraphs 0800-0801, and 0945 of 
Carter). 

t. Referring to claim 21: 

i. Carter further teaches: 

(1) wherein the respective state of the first device is 
determined to be automatic when an automatic reply is programmed to be sent to a 
second address when the first device receives a packet from the second address 
(paragraphs 0800-0801, and 0945 of Carter), 
u. Referring to claim 22: 

i. Carter further teaches: 

(1) wherein the respective state of the first device is 
determined to be omitted (e.g., ignored) (paragraphs 0431, 0870, 0920, and 0966 of 
Carter). 

v. Referring to claim 23: 

i. Carter further teaches: 

(1) wherein the respective state of the first device is 
determined to be omitted when the observing is programmed to omit communication 
with the first device from the observing (paragraphs 0431, 0870, and 0966 of Carter), 
w. Referring to claim 24: 

i. Carter further teaches: 

(1) initializing the respective state of at least one device 
of the plurality of devices to unknown prior to the observing (paragraphs 0260-0261, 
0785, and 0881 of Carter). 

x. Referring to claim 25: 

i. Carter further teaches: 

(1) wherein the plurality of devices communicates via a 
segment (e.g., portion) of a network (paragraphs 0228, 0258, and 0652 of Carter), 
y. Referring to claim 26: 

i. Carter further teaches: 
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(1) maintaining the respective state for one device of the 
at least one device in a storage area (paragraphs 0207 and 0772 of Carter), 
z. Referring to claim 27: 

i. Carter further teaches: 

(1) wherein storing information about at least one packet 
of a plurality of packets communicated between the plurality of devices (paragraphs 
0207 and 0772 of Carter). 

aa. Referring to claims 28-30: 

i. Carter further teaches: 

(1) wherein the information comprises a respective 
source address and a respective destination address and a protocol for each packet of 
the plurality of packets; and a time that each packet of the plurality of packets was sent 
(paragraphs 0208-0216 of Carter). 

ab. Referring to claims 31-42: 

i. These claims consist a system to implement claim 1, thus 
they are rejected with the same rationale applied against claims 1, 10-1 1 ,13-14,16- 
17,19,21,23,26-27 above. 

ac. Referring to claims 43-54: 

i. These claims consist a system to implement claim 1, thus 
they are rejected with the same rationale applied against claims 1, 10-1 1 ,13-14,16- 
17,19,21,23,26-27 above. 

ab. Referring to claims 55-66: 

i. These claims consist a computer-readable medium to 
implement claim 1 , thus they are rejected with the same rationale applied against claims 
1, 10-11,13-14,16-17,19,21,23,26-27 above. 

Claim Rejections - 35 USC § 103 

7. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for 
all obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
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the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

8. Claim 2 is rejected under 35 U.S.C. 103(a) as being unpatentable over 
Carter et al (US 2003/0051026), and further in view of Beach (US 6,067,297). 

a. Referring to claim 2: 

i. Carter further teaches: 

(1) wherein the inferring is performed without sending a 
packet to the at least one device (paragraphs 0057 and 0559 of Carter). 

ii. Although Carter is silent on the capability of showing the 
communication between plurality of devices without the need of sending a packet, 
Beach clearly discloses performed without sending a packet to the at least one device 
(column 18, lines 5-25 of Beach). 

iii. It would have been obvious to a person having ordinary skill 
in the art at the time the invention was made to: 

(1) have modified the invention of Carter with the 
teaching of Beach to provide another alternative approach for use in communications 
network (column 18, line 5 of Beach). 

iv. The ordinary skilled person would have been motivated to: 
(1) have modified the invention of Carter with the 

teaching of Beach to monitoring and protecting networks of computers (paragraph 
0003 of Carter). 

Conclusion 

9. The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. 

a. Bishop et al (US 6,983,317) discloses a Managed Site (10), a 
logical network entity, is composed of a number of Sub Sites (20) in a one to many 
relationship. A Sub Site (20) is a logical component, which is composed of a number of 
Engines (30). Nodes (40) similarly relates to their Engine (30) in a many to one 
relationship. A Node (40) is a collection of Managed Elements (ME's) (50) (while being 
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an ME (50) itself), which represent network state information. The subsite (20) consists 
of the engine (30) connected to server nodes (40). One or more clients (110) are 
connected to the management engine (30) and access management engine (30) 
information relating to managed elements (50) including nodes (40). The connected 
manager engines may communicate with one another so that, for example, in the event 
of a failure, one of the manager engines remaining on line commences monitoring of 
manage elements assigned to the failed manager engine (see abstract). 

b. Love et al (US 6,904,020 B1) discloses a system and method for 
monitoring communication networks using data stream characterization (see abstract). 

c. Fernandez et al (US 6,697,103 B1) discloses an integrated network 
for monitoring remote objects (see abstract). 

Any inquiry concerning this communication or earlier 
communications from the examiner should be directed to Thanhnga (Tanya) Truong 
whose telephone number is 571-272-3858. 

If attempts to reach the examiner by telephone are unsuccessful, 
the examiner's supervisor, Kim Vu can be reached at 571-272-3859. The fax and 
phone numbers for the organization where this application or proceeding is assigned is 
571-273-8300. 

Any inquiry of a general nature or relating to the status of this 
application or proceeding should be directed to the receptionist whose telephone 
number is 571-272-2100. 

TBT 

February 06, 2007 




